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"We intend to... shift from reliance on regulations, controls and 
detailed procedures towards a greater reliance on managers! 
competence and their achievements of results - to simplify 


Government ..." 


< Towards Productive Management - The PC Approach, 
August 28, 19841 


This view of productive management based on results, not process, may require a 
shift in audit emphasis. One good way for value-for-money auditors to contribute 
to productive management is to recommend changes in systems, procedures and 
controls that will result in significant improvements. As recently observed by the 
Office of the Auditor General of Canada in Chapter 5 on Internal Audit in the 
1984 annual Report, marginal recommendations ean produce "additional costs on 
the part of managers, frustration about the additional constraints and controls and 


a negative reaction to the auditor as being impractical and counter productive".2 


Most auditors would agree with the importance of being concerned 
with the impact and effects of their work when planning and carrying out an audit 
and making observations and recommendations. They would concur that they 
should be reasonably satisfied that the benefits of adopting their 
recommendations should outweigh the costs of implementing them. By putting 
themselves in the shoes of management, auditors can more readily identify major 


problem areas. 


The key to thinking like a manager about the costs and benefits of 
audit recommendations is to focus on significant risk areas during the planning 
phase, consider results before testing controls, pinpoint over- and under-control 
situations during field work and screen out irrelevant recommendations during the 


reporting phase. 


Think Like a Manager About Internal Controls 


The auditors' objectives mirror those of a soundly designed system of 


internal control and normally include making a contribution toward: 
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iS improved services to the public; - 

~ cost savings and higher revenues; 

- better use and conservation of resources; 

= enhanced compliance with legislation, policies and directives; 
- deterrence of potential abuse and fraud;3 and 


- improved management practices and controls - including 


eliminating unnecessary controls. 


In short, auditors attempt to pay their own way in the same manner that program 
managers make a significant contribution to the organization. Auditors realize 
that they should achieve the same audit coverage with a lower cost, or achieve 
greater coverage at the same cost by clearly identifying audit objectives and 
focusing on areas of greatest risk of potential loss or failure to take advantage of 
opportunities. Thinking of themselves as managers, auditors realize that they 
must use scarce resources to achieve the desired end of ensuring that the benefits 


of an audit to the organization exceed the costs. 


It is this last point that is most critical to auditors. The benefit to the 
organization from their audits is a "secondary" or "derived" benefit. That is to 
say, auditors do not contribute directly to program results, but rather contribute 
indirectly by making recommendations that improve program performance. 
Ultimately the auditors' success depends on two big "ifs" or risks that could 
diminish their effectiveness. The first risk is that the auditors will not conduct a 
relevant, insightful and practical audit. The second risk is that the auditors will 
make good recommendations, but these recommendations will not be accepted or 
implemented by auditee management. In either case, the auditors have failed to 


maximize their contribution to the organization. 
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One approach to minimizing these risks is to view internal controls 
from the perspective of the program manager. As summarized in Internal Control 
in U.S. Corporations: The State of the Art, a recent study of corporate internal 
control practices, there are inherent limitations and possibilities of internal 
control that must always be kept in the forefront. Auditors must always 
recognize that: 


= perfect internal control is impossible; 


= no system of internal control can guarantee against personal 
failure; 


- the cost of reducing the possibility of errors and irregularity to 
some hypothetical minimum can become so burdensome as to 


interfere seriously with efficiency and economy; and 


- internal control is a desirable means to an end - it should not be 
made an end in itself. Internal control is only one of many 


factors served by programs. 


What is needed is a framework reflecting these realities that can be 
used to classify controls as potentially most cost-effective, least cost-effective 


or marginally cost-effective in controlling results. 


As presented in Exhibit 1, Cost Effectiveness and Controlability of 
Results, some organizational functions and related results are inherently more 
controlable than others. The chart illustrates that the impact of a loss, or a 
reduction in results is inherently higher in some functions than others. Auditors 
concerned with conducting a meaningful audit that examines higher risk, or 
impact, areas of greater significance to management consider the implications of 


Exhibit 1 during the planning and reporting phases of the audit. 
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EXHIBIT 1 COST EFFECTIVENESS AND CONTROLABILITY 
OF RESULTS 


High 


UNCONTROLABLE 
RESULTS 


Impact 
of 
Possible 
Loss 
MARGINAL 
CONTROL 
OVER 
RESULTS 
Low Controllability by Management High 
Action 
EXHIBIT 2 CONTROLABILITY MATRIX 
CONTROLABILITY 
Low High 
High impact/low controlability High impact / high controlability 
Executive override Treasury functions 
Executive integrity Investments and related income 
ic | EDP system abuses and failures Capital expenditures 
| High level bribes Purchasing 
= Credit granting 
Major borrowing 
Inventory / production 
o 
BS 
as Low impact/low controlability Low impact / high controlability 
ae Abuse of telephone privileges | Petty cash disbursements 
Petty thefts | Company cafeteria 
2 Minor unintentional errors Executive perquisites 
} 
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From Internal Control in US Corporations: The State of the Art 
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When making initial scope decisions on what to audit, the auditors will 
focus on activities in the top two boxes in Exhibit 2, Controlability Matrix. For 
an "uncontrollable" result the auditors will analyse the probability of the event 
occurring. The auditors will focus their audit effort on areas where there is a 
high probability of a high impact loss. Conversely, they will tend to avoid audits 
of petty cash disbursements. 


When making recommendations during the reporting phase, the 
auditors will again consider the controlability matrix. For situations that are 
inherently uncontrollable, they will not make recommendations to improve 


controls. 


Building on this appreciation of the inherent limitations and costs of 
internal controls, auditors take into account that effective program managers 
design an overall control framework within the context of the program operations 
to be controlled. Controls are not designed in isolation; rather they are part of 
the overall scheme of things. They are put in place to promote program 
efficiency and effectiveness, rather than impede it. Thus, it is the primary 
responsibility of management to assess the costs and benefits of implementing, or 
not implementing controls. It is the auditors' mandate to identify how well 
management has struck a working balance between under-and over-control of 


results. 


Exhibit 3, Controls and Results, illustrates the interrelationship 
between controls and results. For example, in a manufacturing concern, controls 
over the inventory/production cycle are an integral part of producing final results, 


or products, with due regard for economy, efficiency and effectiveness. 


In the same way that financial controls reduce the possibility of errors 
in the financial statements, other internal controls, such as a perpetual inventory 
system, may contribute to lowering the likelihood of results below expectations. 
Exhibit 3 illustrates this correlation between traditional inventory controls "A to 
M" and such expected results as no stock-outs, low inventory obsolescence, low 
surplus stock or low "shrinkage". Later, it will become clearer how thinking like a 
manager about controls helps the auditors achieve the same audit coverage with 


lower costs, or achieve greater coverage at the same cost. 
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EXHIBIT 3 CONTROLS AND RESULTS 


CONTROLS OVER EXPECTED 


INVENTORY / PRODUCTION LIFECYCLE RESULTS 
NEEDS WAREHOUSING / 
IDENTIFICATION ACQUISITION STORAGE INVENTORY 
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But "thinking management" is just the first step. How might such an 
approach be implemented? Exhibit 4, Risk, Results and a Cost/Benefit Approach 
to Auditing What Is, What Isn't and What Shouldn't Be, outlines a framework for 
conducting such an audit. It traces the audit life cycle that starts with the long- 
term audit planning that precedes any specific audit and ends with the follow-up 
of implemented recommendations. Beginning with the long-term planning 


process, let's look at the proposed audit framework. 


Periodically, auditors stand back and "look at the big picture". They 
consider the results of prior audits, new initiatives that have come to their 
attention, areas of major risk/opportunity, the probability of errors or loss and 
ongoing management concerns. They "slice up" the audit universe into 
manageable audit units that can be scheduled for audit over an annual audit cycle, 
or postponed for future audits. The auditors take a systematic approach to 
identifying their client's audit needs and rationalizing their immediate and longer- 
term audit approach. Like a diamond, there are infinite facets of a client entity 


and there are many different ways to "cut the audit". 


During this macro-level planning process, the auditors identify the key 
program components that ensure ongoing program delivery. They identify major 
users of program resources. They decide to focus their audit effort on high 
impact areas where there is a high probability of loss. These high risk areas 


become manageable audit units. 


Once the manageable audit units have been selected, the auditors 
begin their work on specific audit assignments. As outlined in "Auditing What 
Isn't", an insightful and comprehensive knowledge of the business is the first step 
to creating audit models that assist auditors in evaluating the existing control 
framework.» The outputs of this phase are predetermined and descriptive control/ 
results models. The predetermined control/results models identify all the major 
expected results as well as the controls that should be in place to ensure that 
these results are achieved with due regard for economy, efficiency and 


effectiveness. The descriptive control/results models describe the actual results 
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and related controls that are in place at the time of the audit. A comparison and 


evaluation of the two models generates two preliminary assessments: 
= Results O.K.: Actual results equal or exceed expected results; or 


= Results Not O.K.: Actual results are significantly below expected 
results. 


The auditors, following the rationale illustrated in Exhibit 3, Controls 
and Results, then develop an initial audit strategy based on the belief that "if 
results are adequate, controls are adequate". Thus the auditors link the 
achievement of planned results (i.e., Results O.K.) with the control condition 
Controls O.K. The management control framework designed by auditee 
management is well integrated into program activities and is likely contributing 
to management's objective of achieving results with due regard for economy 
efficiency and effectiveness. The auditors may decide not to audit the system in 
depth. Their rationale: "if the system is operating O.K., why recommend changes 


that will only add to overhead". 


For the second condition, Results Not O.K., the auditors make a 
necessary simplification. They will assume a causal link between results below 


expectation and the following control conditions: 


12 Over Control: A control exists that should not exist. Within the 
overall control framework, there are too many of the wrong kinds of 
control - with the net result of unnecessarily impeding program 


delivery. 


2. Under Control: A control does not exist that should exist. As a result 
program activities and assets are unnecessarily at risk, relative to the 


potential costs of implementing the required management controls. 
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For the first condition, "Controls O.K.", the auditors respond by 
performing limited traditional tests of compliance. These are designed to provide 
assurance to management that their controls are working as planned. The 
auditors also conduct substantive tests of results to ensure reported program 
results are accurate. Normally, the auditors would not conduct any significant 
cost/benefit analysis on these controls unless their tests reveal unanticipated 


costs, other negative impacts or the need for improvement. 


In the case of suspected "over or under control" (conditions 1 and 2), 
the auditors may decide to look at the costs and benefits of selected control 
situations. They will consider using this technique only in cases where changes to 
the existing control framework appear warranted. The auditors may suggest that 
the organization should add controls or, if warranted by their analysis, they may 
suggest that the organization should delete controls. The critical factors in such 
a determination will be the relative costs and benefits of each control area 


| examined. 


If the auditors decide that a detailed cost/benefit analysis is 
appropriate, they will consider both the tangible as well as the intangible 
dimensions of the control situation. Examples of intangible costs are the effects 
on employee morale of closing down an office canteen, or the loss of reputation 
because of a reduction in a guarantee period offered. Examples of intangible 
benefits are better and more timely information or the effects of providing better 


service to customers.® 


Audit recommendations to add or delete controls may have either a 
favourable or unfavourable impact on assets, may reduce or increase revenue or 
outputs and may increase or decrease costs or inputs. The major focus of the 
examination phase is to gather sufficient and appropriate "hard" (quantitative) and 
"soft" (qualitative) evidence to make a meaningful presentation to auditee 


management. 


At the completion of the examination phase the auditors conduct their 


cause and effect analysis and exercise professional judgement. They present 
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management with an overall assessment of both the control framework and 
specific controls within that framework. Their analysis is congruent with 
managements! objectives. To the extent that management has not taken a 
cost/benefit approach to periodically reviewing and updating the controls over 


operations, the auditors teach by example. 


When exercising judgement, the auditors recognize that there is a risk 
they may be wrong. As a result, there may be a loss to program assets that might 
have been avoided had the redundant or inefficient control still been in place. 
The auditors are prepared to live with this consequence of their recommendations 
to delete a control. However, during the reporting and follow-up phases, risks are 
monitored and controlled by reporting back to management the unintended or 


unforeseen impacts of a prior recommendation. 


Through extensive discussions and debriefings with management, the 
auditors "let management write the recommendations". That is, management 
makes the final decision to add or delete controls. The auditors and management 
will reach a consensus as to which controls to add or delete. Management will 
prepare an implementation plan to ensure that these recommendations are put in 
place. The auditors will have acted as an effective catalyst for change, and will 
have made a contribution to the organization by making every effort to ensure 
that their reeommendations do not sit on the shelf, but are put in place. During 
the follow-up phase, the implementation plans will be monitored. The auditors 
will be alert to unanticipated results of their recommendations. Should these 


come to the surface, the auditors will report these back to management. 


Risk and Results Analysis: A Simplified Example 


Conceptually, the risk and results audit approach involves identifying 
high impact areas, assessing the probability, or risk, of losses occurring and 
performing an initial review of results to determine if a more detailed 


examination of program controls is warranted. 
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Putting themselves in the shoes of management, the auditors realize 
that the inventory/production cycle falls into the high impact/high controllability 
grids of Exhibits 1 and 2. The auditors realize that major breakdowns in this cycle 
can have a high impact on overall results. The auditors’ initial assessment of the 


risk of such breakdowns is moderate. There have been some problems in the past. 


The auditors' starting point is managements' stated objective "to have 
the lowest cost/quantity of inventory on hand necessary to meet operational 
needs". The auditors' objective is then to determine whether that is the case. 
This audit objective is translated into results oriented audit criteria. These 
criteria are discussed with management. These criteria represent a reasonable 


level of performance and compare with industry averages. 


The auditors recognize that the cost of stockouts is potentially 


enormous. Their criteria reflect this reality: 


(1) No stockouts during the period of review; 

(2) An X% level of obsolescence; 

(3) Y% of surplus stock tying up scarce working capital; and 
(4) Z% of "shrinkage". 


The auditors compare this predetermined "model" of results against 
actual results reported by management. If results measure up to expectations, 
audit effort during the examination phase will focus on substantive tests of results 
with reduced "traditional" compliance tests. The auditors will not audit all 
detailed operational controls "A to M" in Exhibit 3. As a result, the auditors will 


have achieved their objective of covering the same ground, but in less time. 


The value-for-money auditors will integrate their effort with attest 
audit effort. The year end inventory count will provide information to verify 
assertions on obsolescence and shrinkage. The verification of the perpetual 


inventory system will provide assurance that a key control is working as planned. 
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Building on this simplified example, the next hypothetical case study 
illustrates how cost/benefit analysis is useful in addressing potential over-control, 


or under-control situations. 


The Cost/Benefit Approach: A Simplified Example 


Conceptually, the cost/benefit approach involves four distinct phases: 
the evaluation of the existing control framework; the testing of existing controls; 
an analysis of the costs and benefits associated with observed strengths and 
weaknesses; and the formulation of practical recommendations, based on an 
informed cause and effect analysis. This process can best be illustrated by using a 
hypothetical case study of an audit - the Exhibitions Program of a medium-sized 


provincial museum. 


The exhibitions activity of the program is an organization-wide 
function that in the view of museum management is critical to the overall 
effectiveness of the museum. Senior museum management, aware of both the 
overall contribution and the inherent constraints to developing a realistic control 
system, want the auditors to focus on this activity. In short, both the auditors and 
senior management believe that there are too many of the wrong controls and too 


few of the right controls. 


The auditors realize that the exhibitions activity can be compared to 
making a movie in that it is highly integrated, requires the effective co-ordination 
of many players and draws on a diverse level of skills to produce a final product 
with both tangible and intangible dimensions. In this sense, the exhibitions 


activity can be viewed principally as a "co-ordinating" function. 


Following the approach outlined in "Auditing What Isn't", the auditors 
develop a predetermined control/results models®. The auditors recognize that for 
each phase of the exhibitions activity - program planning, design and fabrication, 
implementation and evaluation and follow-up, there are essential controls that 


should logically be in place to ensure economy, efficiency and effectiveness. 
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The auditors' initial analysis shows that the majority of resources are 
consumed in the program planning phase where an annual exhibition program is 
developed, a portfolio mix is established, themes and ideas are developed and 
transformed into detailed outlines for exhibits, and final approval is granted by an 
exhibitions committee. The next major use of resources is in the design and 
fabrication phase where extensive internal shops actually manufacture the 


tangible outputs of the exhibitions activity, the displays themselves. 


The auditors try to obtain results-based data. They realize that the 
number of exhibitions produced in a year is not a meaningful figure, given the 
unique qualitative dimensions of each exhibition. The approach taken by the 
auditors of the manufacturing concern will not work as easily for a museum. Even 
production in the shops is so "non-standard" that results-based data can be 
misleading. The auditors' analysis indicates that the impact of a loss of 
production and wasted "time" is high in both the program planning and fabrication 
phases. Their risk analysis indicates that the probability of loss is moderate. 
Overtime, over-runs and delays are a recurring reality. By-passing any further 
results analysis, the auditors focus on the operational controls in place to ensure 
exhibitions are managed with due regard for economy, efficiency and 


effectiveness. 


The auditors focus on the controls in place for the program planning 


and fabrication phases of the life-cycle of an exhibit. 
The auditors identify three control conditions: 


i, Controls O.K.: Normal controls exist over expenditures that are 
slated for compliance tests. The auditors also identify that an 
exhibitions committee is a key control to ensure that only "first rate" 
exhibits are approved, accountability for overall project management 
is clearly assigned and costs are controlled. Compliance tests on the 


effectiveness of the exhibitions committee are slated. 
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Ds Over Control: The auditors find that there is a daily count and 
tabulation of plywood stores in the shops. The auditors suspect that 


the costs of this control over materiel inventories exceed the benefits. 


3. Under Control: The auditors note that although plywood is extensively 
controlled, there are no utilization, scheduling or time reporting 
controls over the biggest single cost of the shops, personnel. The 
auditors suspect that the benefits of improved controls would exceed 


the clerical costs of setting up such a system. 


To confirm this initial evaluation, the auditors estimate where each 
type of control would fit on the controlability matrix. The daily count of plywood 
sheets would score in the low impact/high controlability area. The 
utilization/scheduling/time reporting controls would score in the high impact/high 
controlability area. During the examination phase the auditors address the 
technical feasibility of changing the existing control framework as well as 
performing traditional compliance tests designed to provide assurance to 


management that controls are working as planned. 


The Examination and Reporting Phases 


For potential "over and under control" situations identified during the 
planning phase, the auditors gather sufficient appropriate evidence to answer two 


basie questions: 


1. Are changes to the control framework necessary and technically 


feasible? 


jae What are the cost/benefit impacts to the economy, efficiency and 


effectiveness of operations? 


The auditors’ initial focus is on the hard costs and benefits and the realities, 
constraints and opportunities of the operating environment. The auditors decide 
to perform a detailed cost/benefit analysis on the control of human resources in 
the shops. The results of their work are summarized in Exhibit 5, Detailed 


Cost/Benefit Analysis of Shop Costs: Time. 
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EXHIBIT 5 DETAILED COST/BENEFIT ANALYSIS 


OF SHOP COSTS: TIME 


POTENTIAL POTENTIAL 
FINDINGS BENEFITS CONTROL COSTS 
TANGIBLE 

e Annual overtime e Total Estimated _ $40,000 e No incremental cost 

of $100,000. overtime savings — : 
($100,000) (40%) 

e Use of contractors e Total Estimated _ $30,000 e No incremental cost 
at peak times, contract ~ savings — : 
$75,000. ($75,000) (40%) 

e No longer-term e Regular Estimated _ $75,000 e Maintain sceduling 
scheduling, utiliza- time savings 4 system, implement 
tion reports or ($500,000) (15%) manual time reporting 
project costing (1P/Y) ($50,000) 
(time costs). 

e Annual payroll 
of $500,000. 

e Total Potential Benefits = e Total Potential Control 
$145,000 Costs = $50,000 
SIGNIFICANT ASSUMPTIONS: 
, A significant portion (40%) of overtime and contract costs can be eliminated through 


improved forward planning. 
’ The above benefits would be realized the first year of implementation. 


A sizeable portion of regular time could be better managed. The 15% figure is based on 
managements' estimate of current "down" time. 
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Further, the auditors recognize that a degree of creative freedom is 
necessary to encourage and permit excellence in exhibits. Within this context the 
auditors determine that strong "front end" controls during the program planning 
phase are most appropriate to this environment. The auditors conclude that 
project initiators should be permitted an "automatic" 5 per cent over-run with 
minimum justification, but anything more would require going back to the 
exhibitions committee for a formal approval of a change in scope, etc. However, 
clear accountability and a method of tracking actual costs are necessary to make 


this control mechanism an effective deterrent to over-spending. 


The results of the auditors! field work are summarized in the left hand 
column of Exhibit 6, Results of the Audit. The auditors then consider the 
intangible dimensions of the control situations noted. The intangible costs of a 
strengthened exhibitions committee might be a perception by museum curators 
that the bureaucracy was trying to stifle their creativity. On the benefit side, a 
strengthened exhibitions committee that met more frequently would improve 
overall communications between the key participants whose involvement was 
essential to developing a successful exhibition. While the intangible cost of 
eliminating the daily plywood count would be minimal, the benefits on shop 
morale were deemed to be high. In the area of improved utilization/ 
scheduling/time reporting, the intangible costs identified included overcoming 
employee resistance to improved utilization planning. The potential benefits 
included increased employee satisfaction that would come from better work 


planning. This should even out the peaks and valleys in the shop production cycle. 


The results of the audit work are summarized and presented in a 
format that assists managers in managing. The auditors’ objective is balanced 
reporting. They report to management what is going well, what could be better 
and what really doesn't need to be there - and why. As illustrated in Exhibit 6, 
program managers are provided with both the facts and an overall "road map" or 
framework for making informed decisions. They can then decide whether they 
have enough of the right types of control or too many of the wrong types of 
controls. During debriefing meetings, the auditors confirm the facts, letting 
management "write the recommendations". Management makes the ultimate 


decision about changes to the control framework. 
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EXHIBIT 6 


MAJOR 
FINDINGS 


CONTROLS O.K. 


Controls over expenditures 
operating as planned. 


OVER CONTROL 


Daily count and tabulation 
of plywood sheets costs 

at least $25,000; potential 
benefits are estimated at 
$7,500. 


UNDER CONTROL 


The exhibitions committee 
is not effectively preventing 
cost over-runs of up to 20%. 
As a result $200,000 of 
program funds is unneces- 
sarily at risk. 


Shop payroll costs are not 
adequately controlled. 
As a result, avoidable 
contract and overtime 
costs may be incurred. 


Le = 


RESULTS OF THE AUDIT 


AUDITORS' 
INTERPRETATION 


Existing controls contribute 
to ensuring exhibits are 
developed with due regard to 
economy. 


The current control is not 
eost-effective. 


"Control effort" could be 
better spent on improved 
scheduling, etc. 


Strong "front end" controls, 
improved accountability and 
a simplified project costing 
system would be compatible 
with "creative freedom" while 
reducing unanticipated cost 
over-runs. 


The estimated benefits of 
$145,000 from improved 
scheduling and time reporting 
would likely exceed the 
incremental control costs 

of $50,000. 


—————— ee 


MANAGEMENTS! 
INTERPRETATION 


(Auditors’ Response) 


eens 


None. 


e Stop the practice of 


daily plywood counts. 
(Agree). 


An active exhibitions 
committee will 
ensure exhibit 
managers use project 
reports to limit cost 
over-runs to within a 
pre-defined ceiling 
(say 5% of original 
budgets). (Agree). 


Shop management 
will improve 
scheduling and 
implement a project 
costing system. 
(Agree). 
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As a result, the auditors decide to experiment with a new report 
format. Rather than label the right hand column "Recommendations", they label 
it "Managements! Interpretation"’. This change reflects the auditors’ belief that 


good recommendations do not improve performance if they are not implemented. 


This will be accomplished when management works out the parameters 
of a pilot test for implementing time reporting and reducing controls over 
plywood. The internal auditors agree to monitor implementation in six months, 
with a view to performing a more stringent analysis on plywood usage to ensure 


that unanticipated shrinkage has not occurred. 


A Special Case: The Reality of Central Agency Requirements 


While the current trend may be toward de-regulation, central agency 
rules, regulations and requirements will likely remain a reality in the public sector 
environment. Should auditors consider the costs and benefits of such regulations, 
or should they view such an analysis as academic because the regulations should 
be considered a "given" within the client organization? This article argues no. 
Central agency regulations are designed to cover a wide variety of situations. 
Because of their "general" applicability, it is inevitable that they may not be cost 
beneficial for specific program applications, even though for the government as a 
whole they may be cost beneficial. For example, general contracting regulations 
and other central agency procedures may not be applicable to all aspects of the 
operations of a museum. These regulations would have been designed to ensure 
economy, efficiency and effectiveness for the "standard" government operation, 
not the unique operational requirements, challenges and constraints confronting a 
museum funded by public moneys. For certain specialized services contracted by 
the museum, there may only be one specialist in Canada, or even all of North 
America. The three independent quotes required by central agency directives 


may not be possible, let alone cost effective. 


When confronted with such central agency requirements, the auditors 
might review major regulations that have a significant program impact. The 


objectives of their review are to: 
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: Determine whether a special dispensation has already been 


obtained. 


= Identify real, as opposed to imagined, hardship situations. 
Traditionally operational management will complain about the 
impositions caused by central agency requirements. The auditors 


separate the wheat from the chaff. 


= Assess the impact of deleting the control, as well as the 


probability of loss. 


= Document the full costs and benefits of potential hardship 


applications. 


= Consider the feasibility of controlling the situation by 
monitoring results, rather than by "traditional" compliance 


procedures. 


= Prove to auditee management that the benefits of the control do 
in fact exceed the costs or, conversely, assist the client 
organization in preparing a formal submission to the relevant 
central agency, recommending modifications to the regulation 
that is causing hardship. The purpose of this approach is to 
ensure that the client does not "circumvent in silence", but 
rather follows the rules or seeks a formally approved central 


agency dispensation. 


Auditors perceived by program management to be concerned with both 
lightening, as well as increasing, the perceived "bureaucratic" load on 
management will be seen as much more effective and welcomed contributors to 
the management process. This perception will increase the auditors’ overall 
objective of contributing through practical recommendations that are 


implemented, not shelved. 
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An Endless Variety of Applications 


By taking a risk, results and cost/benefit approach to auditing what is, 
what isn't, and what shouldn't be - management is better served. The end result 
of such an audit is both a streamlining and strengthening of the overall control 
framework. This improves organizational performance. During the planning 
phase, the auditors selectively focus on areas of real concern to management that 
afford potential for significant savings. During the examination phase, the 
auditors focus on both "holes" and "bottlenecks" in the control framework, with a 
view to strengthening overall controls but not constraining program results. The 
auditors recognize that control is a means to an end, but not an end in and of 
itself. During the reporting phase, the auditors focus on relevant findings and 
potential recommendations, eliminating the irrelevant from their report. During 
the follow-up phase, the auditors consider the impact of their audit. By following 
a risk, results and a cost/benefit approach to auditing, auditors are successful in 
making improvements in the overall economy, efficiency and effectiveness of the 


program delivery of their client-while conducting a more cost-effective audit. 
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